BENGALURU: The Election Commission may have to alter the way it publishes voter lists on its website if the privacy bill --drafted by the Justice BN Srikrishna committee—becomes law said legal experts.

The EC website publishes a list of registered voters and their personal details including gender and voter ID, both of which are considered sensitive personal information.

The draft bill submitted by the Justice Srikrishna Committee prescribes protecting personal data as an essential facet of information privacy. While the EC’s aim is to combat electoral fraud by enabling authorities to verify a voter’s identity, it would have to obtain ‘specific and explicit consent’ from voters to display their personal details if the bill is passed.

“It is not making data public that is the source of the harm, but (easy) accessibility to the data by bad actors who can cause harm,” said Alok Prasanna Kumar, Senior Resident Fellow at Vidhi Centre for Legal Policy. “We need to think about how we make data public without putting someone at risk.”

Kumar suggested raising the barriers to accessing such data: “If I want a soft copy of the electoral roll I should be able to request it so (the EC) has a record of who has taken the data. Even there, the EC could mask some data that you cannot take.”

Experts said publishing personal data online without any checks throws the data sets open for third parties and could be used for harmful ends.

For instance, the names of people in the voter list coupled with their gender, and house number could be used by stalkers to find out where their target lives and possibly “harm” them.

As on August 6, ET was able to access the poll book of only 23 of the 36 Indian states and union territories from the Election Commission of India website. The links to the remaining 13 e-rolls were either “removed or temporarily unavailable” when this story went to print.

An email questionnaire sent on August 2 to the Election Commission remained unanswered.

The draft privacy law says processing sensitive personal data by the State without the consent of the individual can be done for the functioning of the Parliament or a state Legislature and for providing state benefits to individuals.

The ambiguity extends to other public databases such as land records, list of MGNREGA beneficiaries, First Information Reports, and court records, which are currently not in conformance with the draft privacy bill.

Protecting personal data and restoring control over its ownership and flow has also become imperative ahead of the 2019 Lok Sabha elections, say experts.

For instance, “one of the primary sources of data for political data analytics is the electoral roll that can be downloaded from the Election Commission website,” said Shivam Shankar Singh, an independent political data analyst who builds analytics tools for political parties and government departments.

“From the electoral roll, demographic data of the constituencies can be deduced and used for targeted campaigns in elections via social media,” said Singh, who has worked with electoral roll data during elections in Manipur and Tripura. “Classifying people along caste lines can be done using this demographic profiling technique and is done using data published by EC.”

A July study by the University of Oxford researchers on ‘organized social media manipulation’ has found evidence of such campaigns in 48 countries, including in India. The study found that political parties and governments have spent more than half a billion dollars on implementation of psychological operations and public opinion manipulation over social media.

Facebook, for example, has faced flack for its opaque data sharing practice, after personal data on the platform was used to obtain information on hundreds of thousands of voters globally, including 500,000 people in India.

Jyoti Panday, an Independent privacy Researcher, says the Justice Srikrishna committee has not factored in the need to educate officials and create institutional capacity in complying with privacy norms. “Given an individual's inability to take back control once data has been made public, balancing the individual's right to privacy with public accountability during disclosures is paramount," she said.